Views are always passed model instances as locals, instead of just IDs.

This complements commit 42e0a73811a04a842d2ec206f1bd856e7a40961a: now controllers instance models from the IDs pased in the request parameters, taking care of user permissions, and then pass them as locals to views. There is no need for views to be passed IDs, it makes more sense to pass them full model instances in all cases.